Sherlock

What Sherlock does

Sherlock (legal entity Sherlock Protocol) is a Web3 security platform headquartered in Miami, founded in 2021 by Jack Sanford. The company provides lifecycle security for smart contract-based protocols, spanning the development stage through post-launch operation. Its core offerings are Sherlock AI, Collaborative Audits, Audit Contests, Bug Bounties, and Sherlock Shield (exploit coverage), with a Blackthorn elite audit tier reserved for high-stakes infrastructure reviews. The platform addresses a clearly defined pain point: traditional point-in-time audits leave protocols exposed to vulnerabilities introduced after the audit window, and Sherlock's model layers continuous discovery (bounties), AI-assisted pre-commit analysis, and optional financial coverage to close that gap.

Under the hood, Sherlock operates a community-sourced model with 11,000+ ranked security researchers whose performance data feeds team staffing decisions for each engagement. The Sherlock AI product combines a proprietary two-stage run architecture (discovery and verification) with a planner-and-specialists multi-agent system (Economic Logic, Math and Crypto, State Transition, Code Correctness, MEV Detection, External Integration, Access Control) and beta support for Solana Rust beyond EVM-only analysis. Sherlock Shield adds financial protection up to $500K for live protocols after a covered issue is exploited, layered on top of ongoing bug bounty programs.

Sherlock monetizes through professional services fees on collaborative audits and audit contests, managed-services and platform fees on bug bounty programs (including a stake-to-submit model at $250 USDC per report), insurance premiums on Sherlock Shield, and affiliate referral fees ($1,000 per qualified audit/AI referral, $500 per bounty referral). Customers span DeFi (Aave, Morpho, Sky, Maple, Perennial, Flying Tulip, Usual), L1/L2 infrastructure (Ethereum Foundation, Aptos, Mantle, Babylon, Cosmos/Interchain Labs), cross-chain (LayerZero, MegaETH), and RWA infrastructure (Centrifuge). The platform reports supporting protocols responsible for more than $250B in active TVL, completing over 1,000 private audits and 370+ audit contests, and surfacing 2,000+ critical issues cumulatively. Sherlock has raised $4M in seed funding (September 2022, led by Archetype with CoinFund, Lattice Capital, and The Spartan Group), operates with 1-10 employees, and has not disclosed additional funding or revenue.

Name

Sherlock

Legal name

Sherlock Protocol

Website

https://sherlock.xyz

Company type

Private

Founded year

2021

Operating status

Operating

Headcount range

101–250 employees

Ownership category

akta.pro rank

Product category

Web3 Smart Contract Security Services

NAICS

Security Systems Services (except Locksmiths) (561621), Security Systems Services (56162)

SIC

Security & Commodity Brokers, Dealers, Exchanges & Services (6200), Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Bug Bounty, Vulnerability Disclosure & Security Services (FSAPAJAL)

akta.pro secondary industries

On-Chain Monitoring, Threat Detection & Incident Response (FSAPAJAB), Anti-Cheat, Security & Fraud Prevention for Web3 Games (bot detection, exploit prevention) (FSAPAGAL), Social Engineering / Funds Transfer Fraud Coverage (FSAJAOAI), Cyber Risk Management Services (Pre-Breach Services bundled with Insurance) (FSAJAOAO), Secure Model Deployment & Runtime Protection (sandboxing, isolation) (HDAAAKAH), Secrets Management (Passwords, API Keys, Tokens) (HDADAFAD), Insider Threat Program Design & Risk Assessments (BPAKADAM), Cyber Extortion / Ransomware Coverage (FSAJAOAH)

Keywords

• Smart contract auditing
• Web3 security services
• Bug bounty programs
• Blockchain audit platform
• Smart contract review

Headquarters

HQ city

Miami

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Others

Revenue model

1. Collaborative Audits: Private, senior-led audit engagements where Sherlock assembles a curated team from its ranked researcher network. Pricing varies by scope complexity, codebase size, and team composition. Teams like Blackthorn tier command premium pricing for high-stakes infrastructure reviews.
2. Audit Contests: Time-limited competitive review competitions where protocols open their code to independent researchers. Sherlock takes a fee from the prize pool structure and engagement scoping. Prize pools can range from $100K to $2M+ (e.g., Ethereum Foundation Fusaka contest had $2M max prize pool).
3. Bug Bounties: Ongoing vulnerability discovery programs for deployed protocols. Sherlock provides platform infrastructure, expert triage, and coverage options. Programs include stake-to-submit model ($250 USDC per report) with Sherlock providing adjudication and coverage up to $500K. Revenue from platform fees and coverage premiums.
4. Referral Program: Sherlock pays referral fees to ecosystem participants who introduce protocol teams: $1,000 per qualified audit referral, $1,000 per Sherlock AI referral, $500 per bug bounty referral. Sherlock runs sales and delivery; referrers are compensated when customers purchase.
5. Sherlock Shield Coverage: Optional exploit coverage product for qualifying audited codebases. Provides financial protection during live operation if covered issues appear. Includes post-exploit coverage up to $500K for bug bounty programs.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels7 records

Core offering

Sherlock provides lifecycle security services for Web3 protocols, combining AI-powered smart contract analysis (Sherlock AI), senior-led private audits (Collaborative Audits, including the Blackthorn elite tier), large-scale adversarial contests (Audit Contests), ongoing post-launch vulnerability discovery (Bug Bounties), and financial exploit coverage (Sherlock Shield). Engagements are staffed from a network of 11,000+ ranked security researchers matched to each protocol's architecture.

Product overview

Sherlock is a Web3 lifecycle security platform offering a unified, integrated system of security products spanning development, pre-launch auditing, and post-launch protection. The platform operates as a platform-plus-modules architecture with five core offerings: Sherlock AI (AI-powered smart contract analysis during development), Collaborative Audits (senior-led private reviews), Audit Contests (large-scale adversarial pre-launch reviews), Bug Bounties (ongoing post-launch vulnerability discovery), and Sherlock Shield (financial exploit coverage for live protocols). Blackthorn serves as an elite audit tier within the collaborative audit model, staffed by invite-only top researchers for the highest-stakes engagements. Supporting resources include Docs, Blog, Podcast, Case Studies, a Referral Program, a Lifecycle eBook, Leaderboards, and the Sherlock App. The platform is trusted by leading protocols including Aave, Ethereum Foundation, Morpho, Centrifuge, Perennial, MegaETH, and LayerZero.

Differentiator

Problem solved

Functional benefit

Brands

• Blackthorn: Sherlock's elite tier of auditors, reserved for high-stakes infrastructure and complex scopes, staffed by top-performing Web3 security researchers from Sherlock's network.

Products and services

• Sherlock AI AI-powered smart contract analysis tool that delivers auditor-level analysis during development for Web3 protocol teams, using a two-stage run system (discovery plus verification), domain-specific specialist workflows, and GitHub integration to catch vulnerabilities early.
• Collaborative Audits Private, senior-led code review engagements staffed from Sherlock's ranked researcher network. Sherlock assembles a curated expert team to review a protocol's codebase in a dedicated engagement with close developer collaboration, prior to mainnet or major releases.
• Audit Contests Time-limited competitive security reviews that open a protocol's codebase to hundreds of independent researchers competing to surface the most impactful issues, applying large-scale adversarial pressure before protocol launch.
• Bug Bounties Ongoing post-launch vulnerability discovery programs using a stake-to-submit model ($250 USDC per report, refunded if valid), with expert triage by Sherlock's lead auditors and a 52% hit rate on impactful submissions. Includes post-exploit coverage up to $500K for qualifying programs.
• Sherlock Shield Financial exploit coverage product for live protocols that have been audited, adding a protection layer during active operation if a covered issue is exploited. Includes post-exploit coverage up to $500K for qualifying bug bounty programs.
• Blackthorn Sherlock's elite audit tier, invite-only for top-performing researchers in the network and reserved for high-stakes infrastructure and complex scopes. Blackthorn researchers lead engagements on critical protocols such as Aave V4, Morpho Vaults V2, and the Ethereum Foundation Fusaka upgrade.

Quantifiable outcome

• Supports protocols with $250B+ in active TVL
• +4 more outcomes

Named customers15 records

Segments1 record

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration1 record

AI capability5 records

Feature9 records

Partnerships

Two partnerships are on record, tiered flagship.

• UsualflagshipStrategic or Co-development Partner · 1 March 2026Usual partnered with Sherlock to launch the largest bug bounty in tech history at $16 million for a single critical vulnerability, eclipsing previous records by Uniswap ($15.5M) and LayerZero ($15M). The program covers Usual's full smart contract suite including stablecoin infrastructure, yield distribution, and governance contracts. Sherlock provides its stake-to-submit model with expert triage and post-exploit coverage.
• Ethereum FoundationflagshipStrategic or Co-development Partner · 15 September 2025Ethereum Foundation's Protocol Security Team partnered with Sherlock for a large-scale audit contest as the final stress test before Fusaka's mainnet launch. The 28-day contest drew 510+ researchers with a $2M max prize pool. Sherlock mobilized its researcher network to surface 4 high-severity findings before the December 2025 Fusaka upgrade. The Foundation continues with an ongoing $250K bug bounty.

Scale indicators9 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Code4rena: Code4rena operates audit contests and bug bounties for Web3 protocols, directly competing with Sherlock's contest and bounty offerings. Both platforms use crowdsourced reviewer models to surface vulnerabilities before protocol launches.
• Cantina: Cantina is a newer Web3 security platform offering audits, contests, and bug bounties with a curated researcher network. It competes directly with Sherlock across the audit contest and bug bounty product categories.
• Spearbit: Spearbit provides curated smart contract audit services led by senior security researchers. It directly competes with Sherlock's Collaborative Audits and Blackthorn tier engagements.
• Immunefi: Immunefi is the largest bug bounty platform specifically for Web3, directly competing with Sherlock's Bug Bounty product. Both platforms host ongoing vulnerability disclosure programs with major protocols.
• Zellic: Zellic is a smart contract audit firm specializing in cryptographic and high-stakes protocol audits. It competes for premium audit engagements similar to Sherlock's Blackthorn tier.
• Hacken: Hacken is a Web3 cybersecurity auditor offering smart contract audits, bug bounties, and security scoring services. It competes with Sherlock across multiple security service categories.

Broad incumbents

• OpenZeppelin: OpenZeppelin is a leading smart contract security and development firm offering audits, security libraries, and developer tools. It is a broader incumbent with overlapping audit services but a different model (fixed roster of senior auditors rather than crowdsourced).
• Trail of Bits: Trail of Bits is a well-established cybersecurity firm with significant Web3 smart contract audit practice. It competes for high-stakes audit engagements (e.g., Aave, Morpho) and offers broader security services beyond Web3.
• Consensys Diligence: Consensys Diligence is the audit arm of Consensys, one of the largest Web3 infrastructure companies. It offers smart contract audits and competes for major protocol engagements as a broader incumbent.

Emerging players

• Certora: Certora provides formal verification and security analysis tools for smart contracts. It is an emerging player using a different technical approach (formal verification) that overlaps with Sherlock AI's pre-launch analysis capabilities.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/sherlockdefi
• GitHubgithub.com/sherlock-audit
• LinkedInlinkedin.com/company/sherlock-protocol

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds1 record

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Sherlock